how does an RSA token get out of sync?
In: Technology
The idea of an RSA Token, or any other kind of Rotating Number One Time Password, is that you start at some initial value at some initial time. If both the token and the application that want authorization do the same calculations using that same initial condition, then at any time in the future, they can get the same answer and compare it. This means they know that they were the ones that synced earlier.
If the timekeeping on either device is out of sync, then when you say that the code right now should be “ABCXYZ”, the other end might think “No, right now it’s supposed to be ‘QWERTY'”. Being out of sync means that the trust is gone.
Depending on the system, you put some tolerances in it (i.e., you allow the token to be from N-1 to N+1 iterations out of sync), but that’s mostly for user experience purposes. If you’re truly getting out of sync, then odds are you will eventually hit N-2 or N+2 and be completely out of sync.
As for how, it depends on the system. If it’s something like a Google Authenticator One Time Password system, if the time is *currently* incorrect on either device, then they won’t get the right answer. With something like an actual RSA keyfob, those have their own clocks in them. If that clock is ever inaccurate, then it can gain or lose time. The most common cause would be that the token was in extreme heat or extreme cold, which caused issues with power delivery from the battery, which can affect how fast it clocks.
It has a tiny, battery powered clock inside. The device is not expensive, and that limits the precision of the clock inside. The Host has access to extremely accurate time, so sync problems are certain to occur if you wait long enough. The RSA design has enough tolerance built into it that the design life of the battery is less than the likely time to get out of sync. Some batteries are extra good, some tokens are subject to unusual stresses, stuff can happen.
Latest Answers